CVE-2024-50090: drm/xe/oa: Fix overflow in oa batch buffer
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/oa: Fix overflow in oa batch buffer
By default xebbcreatejob() appends a MIBATCHBUFFEREND to batch buffer, this is not a problem if batch buffer is only used once but oa reuses the batch buffer for the same metric and at each call it appends a MIBATCHBUFFEREND, printing the warning below and then overflowing.
[ 381.072016] ------------[ cut here ]------------ [ 381.072019] xe 0000:00:02.0: [drm] Assertion bb->len 4 + bbprefetch(q->gt) <= size failed! platform: LUNARLAKE subplatform: 1 graphics: Xe2LPG / Xe2HPG 20.04 step B0 media: Xe2LPM / Xe2HPM 20.00 step B0 tile: 0 VRAM 0 B GT: 0 type 1
So here checking if batch buffer already have MIBATCHBUFFEREND if not append it.
v2: - simply fix, suggestion from Ashutosh
(cherry picked from commit 9ba0e0f30ca42a98af3689460063edfb6315718a)
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Configuration
Update drm/xe/oa batch buffer handling to check whether the batch buffer already contains MI_BATCH_BUFFER_END; if it does not, append MI_BATCH_BUFFER_END. This prevents oa reusing the batch buffer for the same metric from repeatedly appending MI_BATCH_BUFFER_END and overflowing (fixes drm/xe/oa: Fix overflow in oa batch buffer).
Linux kernel drm/xe/oa MI_BATCH_BUFFER_END append logic = Append MI_BATCH_BUFFER_END only if the oa batch buffer does not already contain MI_BATCH_BUFFER_END; otherwise do not append again when reusing the batch buffer
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50090?
CVE-2024-50090 is rated as moderate severity as it may lead to data corruption in specific scenarios.
How do I fix CVE-2024-50090?
To fix CVE-2024-50090, update your Linux kernel to version 6.11.4 or later.
Which systems are affected by CVE-2024-50090?
CVE-2024-50090 affects Linux kernel versions prior to 6.11.4.
What are the potential consequences of CVE-2024-50090?
CVE-2024-50090 could lead to an overflow in the OA batch buffer, causing incorrect processing or system instability.
Is CVE-2024-50090 being actively exploited?
As of now, there have been no public reports indicating that CVE-2024-50090 is actively being exploited.